The identification and authentication of users by a combination of a username or username and password (or knowledge) has been a consistent aspect of multi-user computing systems since at least the early 1960's. This likely original use was to identify and authenticate system users and the amount of expensive computation time used on these shared systems. Ironically, it has been reported that one of these original users also hacked the password authentication on these early systems to steal computing resources for his graduate school project.
Nearly 50 years later, although implemented with a variety of cryptography technologies and for an increasingly wide variety of applications, the user experience has remained the same, or worsened. Unlike in 1962, today's users have a multitude of accounts and passwords to remember. According to a large scale study done by Microsoft in 2007, within the controlled group of users, the average user accessed roughly 25 different systems online which require passwords. The study reported that the average number of actual distinct passwords used by the participants was 6.5, however, across only 3.9 sites each. Average participant users each typed on average 8 passwords every day. Other studies report both higher numbers of average accounts and lower numbers of user-generated passwords.
Already overwhelmed by the mental gymnastics that mere routine online usage was asking of them, the burden appears to be unbounded. Web account and resource users are increasingly asked or required to use more complex passwords, with restrictions such as a minimum length, a combinations of letters, numbers, non-alphanumeric characters, and/or a mix of upper and lower case characters.
In order to cope with this increasingly daunting memorization task, users have developed various strategies, from keeping lists of passwords, or using just one or two easily memorized passwords, to the liberal use of post-it notes attached to their monitor.
The typical user password memory assistance strategies such as 1) repeated user entry of a password during the day, perhaps from multiple locations, 2) the usage of a password for multiple authentications, and 3) the physically vulnerable use of password lists and post-it notes in shared office space, each pose security risks. For example, the more times and locations a user is required to enter passwords during the day, the more frequently they become vulnerable to attacks such as malicious key-logging Trojans, password phishing, or man-in-the-middle attacks over shared or wireless networks, among many others. And when users access multiple secure sites using the same password, a stolen password for one site is stolen for all of them.
Real world examples of password security breaches and malicious password threats are everywhere. In a single notorious password data breach in 2007, on Rockstar.com, a gaming site, 32 million user passwords were stolen and posted online publicly the same day. Another style of attack, phishing, where the attacker impersonates a known web site or entity identity known to the target, seems to be proliferating virtually unabated, despite well publicized warnings. According to Fraudwatch International, between just Feb. 15 and Mar. 15 of 2013, no less than 25 widespread online banking password phishing attacks were launched, with the attackers posing as major international banks. In an elaborate attack on PayPal users, the website address and even security certificate were spoofed for the fake site, and many users unsuspectingly entered their credentials into the spoofed interface.
Of course these problems are well known and considerable efforts have been made to improve either the username/password authentication model, or the technical implementation security. Technical improvements in cryptography have improved the ability to withstand brute force attacks, and the use of certificate authorities has made phishing attacks and man-in-the middle attacks more difficult. Unfortunately, few solutions have been adopted to address the high volume of passwords and use of repeated passwords as they are generally more cumbersome for users. Thus the convenience for the user must be considered carefully when developing identity authentication methods.
The common (special) case where a user wants to securely access web sites from a single, private, presumably secure computer, has presented an opportunity for new technical solutions. One solution utilizes browser cookies and tokenized credentials for users. When users return to these web sites which they have already provided credentials to access, they have the option to not use any credentials for the repeat access, see U.S. Pat. No. 5,727,163 Weiss. An extension of this solution for placing merchant orders online by the so-called I-click ordering, see U.S. Pat. No. 5,960,411 Hartman, et. al. Such credentials could be reasonably kept secret from other users of the computer system by cryptographic tokens however, the user must be logged out of the secure site to preserve any privacy or security. Thus these methods still rely upon the still highly problematic username/password credential model. Also, although unusual, but perhaps not for long, attacks on SSL cryptography, including decrypting these credential tokens, has been documented in the literature.
Another technical innovation, which assists users in managing the complex use of passwords is known as a password key-ring, or password manager. This utility is a software application and database that store encrypted and tokenized information corresponding to a user's passwords and associated resources which are to be authenticated, U.S. Pat. No. 5,655,077 Jones, et. al. U.S. Pat. No. 7,076,095 Hahn, US Appl. 2004/0193925 Safriel, and Roboform from Siber Systems (www.roboform.com). Although useful, these solutions utilize complex implementations, require diligence by the user to incorporate infrequently visited secure online resources, and remain vulnerable to a number of attacks such as malicious Trojan key-loggers.
Not all online resources necessitate the same level of security or privacy. This provides an opportunity for innovative solutions which are currently undeveloped. At present, no system or method is available that utilize the wide variations in online resource privacy needs in order to provide a user identified access without the use of any explicitly entered, tokenized or otherwise transmitted password or other unique authentication factor (biometric, smartcard, etc.).